NoRunPI: Run Your Payload Without Running Your Payload
Since "SettingSyncHost.exe -Embedding" Runs a Thread On "SHCore.dll!Ordinal172+0x100", We can hijack the flow before this thread start, to do that :
Load shcore.dll to calculate the thread's entry
Create "SettingSyncHost.exe -Embedding" Process
BruteForce the address calculated (stop when its valid)
suspend the process
inject the payload to the calculated address
resume the process
$$
DEMO:
Note That This is An idea more than a stable poc on a process injection technique, you can find a lot of such processes (creating such threads) and implement your own code using the same way for the same results ... (for example on my machine, the same process have a thread on combase.dll!InternalTlsAllocData+0x70)